Bug 117280 - JSC: Crash beneath cti_op_div @ http://gmailblog.blogspot.com
Summary: JSC: Crash beneath cti_op_div @ http://gmailblog.blogspot.com
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Michael Saboff
Keywords: InRadar
: 116052 (view as bug list)
Depends on:
Reported: 2013-06-05 21:41 PDT by Michael Saboff
Modified: 2013-06-06 15:51 PDT (History)
1 user (show)

See Also:

Patch (5.84 KB, patch)
2013-06-05 22:01 PDT, Michael Saboff
fpizlo: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Saboff 2013-06-05 21:41:05 PDT
We are crashing because an argument variable is been speculated to be an Int32, but there isn't a corresponding speculation check on entry to the function.  When it is call with a non-int value and we OSR exit for some other reason we crash in the baseline JIT because the tag is bogus.
Comment 1 Michael Saboff 2013-06-05 21:41:22 PDT
Comment 2 Michael Saboff 2013-06-05 22:01:33 PDT
Created attachment 203903 [details]

This fixes the problem by merging the various attributes of a VariableAccessData with the root node of the unified set of VariableAccessData nodes.  Before we were merging with a leaf node and therefore the merge didn't propgate to the code generation phase.

This is performance neutral on SunSpider and V8.
Comment 3 Michael Saboff 2013-06-06 08:37:24 PDT
Committed r151273: <http://trac.webkit.org/changeset/151273>
Comment 4 Alexey Proskuryakov 2013-06-06 15:51:31 PDT
*** Bug 116052 has been marked as a duplicate of this bug. ***